Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe
-
Size
712KB
-
MD5
5003d4cd28464abc4d60e0a4ee3734e1
-
SHA1
11be1259b328de49788ddbcf5daf0c3b03fec974
-
SHA256
6a0afb05fcd1ca83cb7ec777cca1be1d931ea8e758be1c604922cf95e5ccdddf
-
SHA512
0de347bfabaf5d6aeae59347430302db31244e61cab78cf2a65615fa9b101b48f3d0f4d9316e83c1b97bb31b53bb531a1e485e4a5b675ca12aa6e82b0fe72fe8
-
SSDEEP
12288:FU5rCOTeiDbBd0Xb2K+W8cfA8YKti6iNZdCvq5TJLCvY90D8/LVBlVk736Y79GWm:FUQOJDbbq2DkYui6iNnCvq5TJLCvY90E
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2992 82BD.tmp 1624 833A.tmp 2604 83E5.tmp 1240 8482.tmp 2052 84DF.tmp 4780 856C.tmp 4960 85E9.tmp 808 8647.tmp 2176 86D3.tmp 4788 8770.tmp 3524 87ED.tmp 4764 8879.tmp 2652 88E7.tmp 5076 8944.tmp 4956 89C1.tmp 912 8A3E.tmp 3276 8A9C.tmp 2672 8AEA.tmp 4084 8B67.tmp 4952 8C04.tmp 2932 8CA0.tmp 3788 8D3C.tmp 208 8DC9.tmp 1496 8E55.tmp 1836 8EF2.tmp 860 8F7E.tmp 232 8FEC.tmp 4596 9088.tmp 4260 90F5.tmp 1028 9172.tmp 5092 91EF.tmp 2184 925D.tmp 3832 92F9.tmp 3584 9366.tmp 3028 93C4.tmp 432 9412.tmp 4484 9470.tmp 4000 94BE.tmp 2008 950C.tmp 3112 956A.tmp 2136 95C8.tmp 4444 9625.tmp 1644 9683.tmp 680 96E1.tmp 1336 973F.tmp 1988 979C.tmp 2784 97FA.tmp 4008 9858.tmp 436 98A6.tmp 2356 9904.tmp 3380 9961.tmp 4708 99B0.tmp 3316 9A0D.tmp 2656 9A6B.tmp 1228 9AC9.tmp 4764 9B27.tmp 3732 9B84.tmp 2592 9BE2.tmp 2816 9C40.tmp 5076 9C9E.tmp 4956 9CEC.tmp 2988 9D49.tmp 2704 9DA7.tmp 1788 9E05.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 912F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 464B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6879.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F01D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9858.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 534B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D712.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2992 1028 2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe 84 PID 1028 wrote to memory of 2992 1028 2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe 84 PID 1028 wrote to memory of 2992 1028 2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe 84 PID 2992 wrote to memory of 1624 2992 82BD.tmp 86 PID 2992 wrote to memory of 1624 2992 82BD.tmp 86 PID 2992 wrote to memory of 1624 2992 82BD.tmp 86 PID 1624 wrote to memory of 2604 1624 833A.tmp 88 PID 1624 wrote to memory of 2604 1624 833A.tmp 88 PID 1624 wrote to memory of 2604 1624 833A.tmp 88 PID 2604 wrote to memory of 1240 2604 83E5.tmp 89 PID 2604 wrote to memory of 1240 2604 83E5.tmp 89 PID 2604 wrote to memory of 1240 2604 83E5.tmp 89 PID 1240 wrote to memory of 2052 1240 8482.tmp 90 PID 1240 wrote to memory of 2052 1240 8482.tmp 90 PID 1240 wrote to memory of 2052 1240 8482.tmp 90 PID 2052 wrote to memory of 4780 2052 84DF.tmp 91 PID 2052 wrote to memory of 4780 2052 84DF.tmp 91 PID 2052 wrote to memory of 4780 2052 84DF.tmp 91 PID 4780 wrote to memory of 4960 4780 856C.tmp 92 PID 4780 wrote to memory of 4960 4780 856C.tmp 92 PID 4780 wrote to memory of 4960 4780 856C.tmp 92 PID 4960 wrote to memory of 808 4960 85E9.tmp 93 PID 4960 wrote to memory of 808 4960 85E9.tmp 93 PID 4960 wrote to memory of 808 4960 85E9.tmp 93 PID 808 wrote to memory of 2176 808 8647.tmp 94 PID 808 wrote to memory of 2176 808 8647.tmp 94 PID 808 wrote to memory of 2176 808 8647.tmp 94 PID 2176 wrote to memory of 4788 2176 86D3.tmp 96 PID 2176 wrote to memory of 4788 2176 86D3.tmp 96 PID 2176 wrote to memory of 4788 2176 86D3.tmp 96 PID 4788 wrote to memory of 3524 4788 8770.tmp 97 PID 4788 wrote to memory of 3524 4788 8770.tmp 97 PID 4788 wrote to memory of 3524 4788 8770.tmp 97 PID 3524 wrote to memory of 4764 3524 87ED.tmp 98 PID 3524 wrote to memory of 4764 3524 87ED.tmp 98 PID 3524 wrote to memory of 4764 3524 87ED.tmp 98 PID 4764 wrote to memory of 2652 4764 8879.tmp 99 PID 4764 wrote to memory of 2652 4764 8879.tmp 99 PID 4764 wrote to memory of 2652 4764 8879.tmp 99 PID 2652 wrote to memory of 5076 2652 88E7.tmp 100 PID 2652 wrote to memory of 5076 2652 88E7.tmp 100 PID 2652 wrote to memory of 5076 2652 88E7.tmp 100 PID 5076 wrote to memory of 4956 5076 8944.tmp 101 PID 5076 wrote to memory of 4956 5076 8944.tmp 101 PID 5076 wrote to memory of 4956 5076 8944.tmp 101 PID 4956 wrote to memory of 912 4956 89C1.tmp 102 PID 4956 wrote to memory of 912 4956 89C1.tmp 102 PID 4956 wrote to memory of 912 4956 89C1.tmp 102 PID 912 wrote to memory of 3276 912 8A3E.tmp 103 PID 912 wrote to memory of 3276 912 8A3E.tmp 103 PID 912 wrote to memory of 3276 912 8A3E.tmp 103 PID 3276 wrote to memory of 2672 3276 8A9C.tmp 104 PID 3276 wrote to memory of 2672 3276 8A9C.tmp 104 PID 3276 wrote to memory of 2672 3276 8A9C.tmp 104 PID 2672 wrote to memory of 4084 2672 8AEA.tmp 105 PID 2672 wrote to memory of 4084 2672 8AEA.tmp 105 PID 2672 wrote to memory of 4084 2672 8AEA.tmp 105 PID 4084 wrote to memory of 4952 4084 8B67.tmp 106 PID 4084 wrote to memory of 4952 4084 8B67.tmp 106 PID 4084 wrote to memory of 4952 4084 8B67.tmp 106 PID 4952 wrote to memory of 2932 4952 8C04.tmp 109 PID 4952 wrote to memory of 2932 4952 8C04.tmp 109 PID 4952 wrote to memory of 2932 4952 8C04.tmp 109 PID 2932 wrote to memory of 3788 2932 8CA0.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_5003d4cd28464abc4d60e0a4ee3734e1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"23⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"24⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"25⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"26⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"27⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"28⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"29⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"30⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"31⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"32⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"33⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"34⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"35⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"36⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"37⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"38⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"39⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"40⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"41⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"42⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"43⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"44⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"45⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"46⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"47⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"48⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"50⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"51⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"52⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"53⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"54⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"55⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"56⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"57⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"58⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"59⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"61⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"62⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"63⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"64⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"66⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"67⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"68⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"69⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"70⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"72⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"73⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"74⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"75⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"76⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"77⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"78⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"79⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"80⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"81⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"82⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"83⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"84⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"85⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"86⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"87⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"88⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"89⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"90⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"92⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"93⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"94⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"95⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"96⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"97⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"98⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"99⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"100⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"101⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"102⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"103⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"105⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"106⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"107⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"108⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"109⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"110⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"111⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"112⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"113⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"114⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"115⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"116⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"117⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"118⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"119⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"121⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"122⤵PID:3548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-